Skip to content

Commit 323d594

Browse files
committed
Fix GH-17921 socket_read/socket_recv overflows on buffer size.
update the existing checks to be more straightforward instead of counting on undefined behavior.
1 parent 9306248 commit 323d594

File tree

2 files changed

+17
-2
lines changed

2 files changed

+17
-2
lines changed

ext/sockets/sockets.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -884,7 +884,7 @@ PHP_FUNCTION(socket_read)
884884
ENSURE_SOCKET_VALID(php_sock);
885885

886886
/* overflow check */
887-
if ((length + 1) < 2) {
887+
if (length == ZEND_LONG_MAX) {
888888
RETURN_FALSE;
889889
}
890890

@@ -1326,7 +1326,7 @@ PHP_FUNCTION(socket_recv)
13261326
ENSURE_SOCKET_VALID(php_sock);
13271327

13281328
/* overflow check */
1329-
if ((len + 1) < 2) {
1329+
if (len <= 0 || len == ZEND_LONG_MAX) {
13301330
RETURN_FALSE;
13311331
}
13321332

ext/sockets/tests/gh17921.phpt

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
--TEST--
2+
GH-16267 - overflow on socket_strerror argument
3+
--EXTENSIONS--
4+
sockets
5+
--FILE--
6+
<?php
7+
$s_c_l = socket_create_listen(0);
8+
var_dump(socket_read($s_c_l, PHP_INT_MAX));
9+
$a = "";
10+
$len = PHP_INT_MAX;
11+
var_dump(socket_recv($s_c_l, $a, $len, 0));
12+
?>
13+
--EXPECT--
14+
bool(false)
15+
bool(false)

0 commit comments

Comments
 (0)